ttps- courses/25983/quizzes/65004/take viewed by the instructor, so your final g
ID: 3700743 • Letter: T
Question
ttps- courses/25983/quizzes/65004/take viewed by the instructor, so your final grade won't appear until after the quiz has been graded. D | Question 1 1 pts SIEM combines functions into one security management system. O security internal management and security external management O security information management and security event management O security impact management and security expectation management O security internal management and security event management DQuestion 2 1 pts is an essential capability of an analytics-driven SIEM because the longer it takes to detect a threat, the more damage it can possibly inflict. O Advanced threat detection O Incident response O Real-time monitoring O Threat intelligence D Question 3 1 pts Peer group profiling, anomaly detection, and entity relationship modeling are key methods,Explanation / Answer
1) Security information management (SIM) and security event management (SEM)
- It collects the related data from multiple locations about enterprise security and analyze as a single point of view which helps to get trends and pattern to detect malicious activities.
2) Real time monitoring
-IT organizations need a real time monitoring which can be applied to any data set and should retrieve the data in order to produce alerts which helps in early detection of threat.
3) Advanced analytics
4) Splunk
-This is a web style interface which takes in data from multiple sources and provides set of data to analyze the patterns pit holes etc.
5) Security information and event management
6) True
-Compliance reporting will consider does all the access has been given as per required roles.
7) Analytics
-Analytics process goes through the complete set of data and gives a platform to see the insights which help find hidden facts.
8) Monitor for Logon Failures
-The system where internet facing and system which contain confidential data are prone to attack and this helps detect such attempts
9) Monitor for Administrative and Guest Logon Failures
-Attackers try to attack known user accounts and this helps in detecting those.
10) Security Posture dashboard
-This is designed to provide high level insights and this is suitable to display in Security Operations Center
11) True
12) Protocol Intelligence
13) Web Center
14) Monitor for administrative shares being accessed
15) Network Domain
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.